Norman Scanner Engine 5.83. 2
Sandbox 05.83, dated 15/08-2005
Your message ID (for later reference): 20050915-902
nepenthes-036eaa23359dfda500a0a1568f9c8eed-bling.exe : [SANDBOX] contains a security risk - W32/Backdoor (Signature: W32/Spybot.RYH)
[ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* File length: 122880 bytes.
[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM\NPFMONTR32.exe.
* Deletes file 1.
[ Changes to registry ]
* Creates value "NPF Value"="NPFMONTR32.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
* Creates value "NPF Value"="NPFMONTR32.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices".
* Creates key "HKCU\Software\Microsoft\OLE".
* Sets value "NPF Value"="NPFMONTR32.exe" in key "HKCU\Software\Microsoft\OLE".
* Sets value "restrictanonymous"="" in key "HKLM\System\CurrentControlSet\Control\Lsa".
[ Network services ]
* Looks for an Internet connection.
* Connects to "scan0r.warez-net.net" on port 6667 (TCP).
* Connects to IRC server.
* IRC: Uses nickname |80340.
* IRC: Uses username ezkieya.
* IRC: Joins channel #.#utopia#.# with password utopia420-WnCz.
* IRC: Sets the usermode for user |80340 to -x-i.
* Attempts to delete share named "IPC$" on local system.
* Attempts to delete share named "ADMIN$" on local system.
* Attempts to delete share named "C$" on local system.
* Attempts to delete share named "D$" on local system.
[ Process/window information ]
* Creates a mutex fux0r-wnc.
* Will automatically restart after boot (I'll be back...).
* Enumerates running processes.
* Enumerates running processes several parses....
(C) 2004 Norman ASA. All Rights Reserved.
The material presented is distributed by Norman ASA as an information source only.
Sent by removed@email.com to sandbox.
Received 15.Sep 2005 at 21.37 - processed 15.Sep 2005 at 21.41.
